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ABSTRACT 


A general  description  of  the  Flight  Safety 
Prediction  Technique,  and  the  documentation 
associated  with  Its  specific  application  to  the 
B-52G  and  B-52H  aircraft,  are  presented. 


ACC!;ss:''N 

for 

— 

•l'!S 

W>ile  Section 

Butt  Section  □ I 

□ 

1 •>'  1 ' 
k)  1 »v»-  • 

irt  

— 

DISi!tlS‘JI!9H/WWUBIlirf  CIH)[S_ 

r- 

J or  SPtCJM.  1 

1 

111/lv 


GLOSSARY 


This  glossary  presents  general  definitions  of  terms  used  In  this  report.  The 
reader  will  find  certain  of  these  terms  defined  In  somewhat  different  words  in  the 
text,  depending  on  the  context  of  the  discussion;  but  the  meaning  will  be  consistent 
with  the  definitions  given  here. 


Criticality 


Dependency 

FSPT 

Flight  Phases 

Functional  Analysis 

Functional  Link 

Functional  Path 
Link  Dependency 
Provisory  Condition 

Provisory  Factor 

Safety  Sensitivity 


A numerical  Index  of  the  significance  of  equipment  failure 
history  relative  to  aircraft  safety.  As  an  analysis  param- 
eter, It  can  be  considered  proportional  to  the  likelihood  that 
an  item  will  fail  and  thereby  cause  an  accident.  It  is  the 
product  of  the  failure  probability  and  the  sensitivity  of  an 
equipment  item. 

See  link  dependency. 

Flight  Safety  Prediction  Technique 

Discrete  segments  of  the  aircraft  mission  profile.  For 
present  purposes,  the  flight  phases  are  defined  as  1)  startup 
and  taxi,  2)  takeoff,  3)  climb,  4)  cruise,  5)  tactics, 

6)  cruise,  7)  descend,  8)  land,  and  9)  taxi  and  shutdown. 

The  determination  of  equipment  relationships  to  aircraft 
functions  performed,  and  the  interrelationships  of  these 
functions. 

The  simplest  form  of  functional  relationship  in  which  one 
function  is  dependent  upon  the  next  lower  function. 

The  compilation  of  functional  links,  in  sequence,  through 
which  a function  Is  Identified  as  being  dependent  upon  another. 

The  conditional  probability  of  a dependent  function  failing, 
given  that  a particular  function  It  is  dependent  upon  has  failed. 

Operation  of  an  aircraft  In  a mode  or  environment  such  that 
the  safety-related  importance  of  certain  equipments  is 
Increased.  Provisory  conditions  include  Icing,  night  flight, 
supersonic  flight,  etc. 

The  probability  that  a provisory  condition  exists.  Also  used 
to  describe  the  coded  notation  used  to  indicate  that  a functional 
relationship  is  dependent  on  a particular  provisory  condition. 

Same  as  "sensitivity". 
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Sensitivity 


Sensitivity  Path 


- A quantitative  indication  of  the  deni  ee  «)f  saf(‘tv  dcni-afliition 
to  be  expected  if  a function  or  piece  «)f  ecfuipment  fails,  'I  hi 
more  specific  terms  are  "functional  sensitivitv"  or  "c((uip- 
ment  Item  sensitivity". 

- A particular  sequence  of  functional  dependencies  (bcRinninn 
at  the  top  level  in  the  hierarchical  structure)  through  which 
a function  or  piece  of  equipment  derives  a sensitivity  value. 
Equipment  and  functional  sensitivitv  values  are  often 
derived  through  several  such  sensitivitv  paths. 
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, FOREWORD 


T This  document  Is  part  of  a 16-volume  report  describitiR  the  application  to 

I specific  aircraft  types  of  ARINC  Research  Corporation's  Flight  Safety  Prediction 

Technique  (FSPT),  The  technique  was  developed  under  previous  Air  Force  contracts 
(see  Appendix  A).  The  present  effort,  undertaken  in  1972  under  Contract  F09603-72- 
j A-1132-SA01,  has  led  to  further  refinement  of  the  FSPT  through  its  broad  application 

I-  to  many  different  types  of  aircraft.  The  flight  safety  models  generated  for  these  air- 


craft  are  presented  In  individual  volumes  of  this 

report  as  follows: 

1 Volume 

Aircraft 

Volume 

Aircraft 

T-38 

10 

B-52G,  H 

i.  3 

F-lllA,  FB-lllA 

11 

C-130E 

4 

A-7D 

12 

KC-135 

1 ® 

F-4D,  E;  and  RF-4C 

13 

C-5A 

6 

C-141 

14 

T-39 

f 7 

A-37 

15 

F-15 

V-  g 

i 9 

0-2 

OV-10 

16 

UH-IN  Helicopter 

Volume  16  will  document  the  results  of  a feasibility  study  of  extending  the  FSPT 
to  rotary-wing  aircraft. 

Volume  1,  an  overall  summary  of  the  contractual  effort,  will  be  issued  at  the 
end  of  the  contract  period. 
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INTRODUCTION 


The  Flight  Safety  Proriictlon  Technique  developed  by  AlUNC  Hesearch 
Corporation  provides  for  assessment  of  the  impact  on  flight  safety  of  the  failure  of 
specific  items  of  equipment  within  an  aircraft.  In  the  FSP'l',  mathematical  modeling 
procedures  are  applied  for  processing  aircraft-equipment  failure  data  to  yield  a 
quantified  index  ranking  safety-related  problems  on  the  basis  of  their  likelihood  of 
occurrence  and  the  resulting  degradation  in  the  aircraft’s  capability  to  fly. 

The  ranking  factor  is  called  "criticality",  which  in  its  simplest  form  is  the 
product  of  the  failure  probability  and  flight-safety  sensitivity  of  an  equipment.  (A 
more  detailed  definition  appears  in  Section  2 and  Appendix  R.)  The  failure  probability 
inputs  are  from  basic  failure-data  sources,  AFM  fifi-1  and  05-110.  The  sensitivity 
estimates  are  derived  by  the  following  process: 

a.  Systematic  analysis  of  aircraft  functions  to  determine  those  essential 
to  flight  safety 

b.  Identification  of  the  hardware  required  to  perform  these  functions 

c.  Evaluation  of  the  safety  significance  of  the  hardware  in  performing 
these  essential  aircraft  functions. 

The  criticality  values  resulting  from  this  approach  provide  a relative  ranking  of 
all  malfunctions  with  respect  to  their  safety  significance.  Figure  1-1  is  a simplified 
example  of  how  three  equipment  items  would  be  ranked  on  the  combined  basis  of  their 
failure  probability  and  safety  sensitivity.  This  figure  Illustrates  an  example  in  which 
item  A has  the  highest  failure  probability,  but  due  to  the  low  sensitivity  value  is 
ranked  below  item  B in  criticality. 


The  methodology'  has  the  ability  to  rank  malfunction  problems  currently  and 
continuously  by  their  accident  potential.  This  ranking,  based  on  criticality  assess- 
ment, can  provide  the  basic  parameters  necessary  for: 

a.  Identifying  equipment  items  whose  failure  history  and  application  pose 
a threat  to  aircraft  safety 

b.  Quantifying  the  degree  of  threat  associated  with  each  equipment  item 

c.  Evaluating  and  tracking  the  effectiveness  of  modifications  to  the  aircraft 

d.  Assessing  safety  benefits  versus  the  cost  of  proposed  aircraft  modifica- 
tions, changes  in  maintenance  or  flight  operations,  or  alternative  aircraft 
designs. 
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Failure 

Probability 


Sensitivity 


Criticality 

Rank 


CRITICALITY  • P x S 
Where  P • Probability  of  failure 

S • Safrty  sensitivity:  the  accident  exposure 
associated  with  each  failure  occurrence 

Flpurp  1-1.  KxaTnple  of  Criticality  Ranking  I’rocoss 

In  this  report.  Section  I and  Appendix  11  pertain  specifically  to  the  I1-.')2G  and 
B-r)2H  aircraft.  The  remainder  of  the  document  provides  support  information  that  will 
make  the  n-r>2  data,  and  the  methoti  by  which  the  data  were  obtained,  more  meaning- 
ful to  the  ,;eneral  reader. 

Section  2 presents  an  overview  of  the  development  and  utiliT’.ation  of  the  Flight 
Safety  Prediction  Technique;  Section  2 discusses  the  steps  associated  with  noneratinp, 
a safety  model  for  calculatlnn  the  safety  criticality  of  various  eciulpments  of  an  air- 
craft; and  Section  4 describes  how  the  safety  models  for  the  ll-.TiG  and  11-2211  aircraft 
were  developed.  Appendix  A summarizes  the  contractual  history  of  the  development 
of  the  FSPT;  Appendix  B discusses  mathematical  considerations  underlying  the  ti'ch- 
nlque;  Appendix  C discusses  FSPT  documentation  methods;  and  Appeniilx  U presents 
functional  relationship  dlani’ams  and  a llstlnp;  of  keypunch  cards  that  comprise  the 
safety  model  documentation  for  the  Br)2G  and  B-r>2il  aircraft. 


) 


1-2 


2 

METHODOLOGY  UNDERLYING  FSPT 


This  section  discusses  the  basic  definitions  and  mathematical  concepts 
associated  with  the  Flight  Safety  Prediction  Technique. 

I 

2. 1 DEFINITION  OF  SAFE  AIRCRAFT  j 

To  develop  a relative  measure  of  aircraft  safety  degradation  resulting  from 
specific  equipment  malfunctions,  it  is  first  necessary  to  define  a "safe"  aircraft.  For 
purposes  of  fte  FSPT  assessments,  an  aircraft  is  assumed  to  be  in  a safe  condition  if 
it  is  operating  within  its  prescribed  performance  limits.  Conversely,  an  aircraft 
operating  (or  about  to  operate)  outside  these  limits  is  considered  to  bo  unsafe  - in  a j 

condition  where  proper^  damage  and  personal  injury  may  result.  i 

The  safety  prediction  methodology  does  not  attempt  to  assess  the  extent  of  t 

possible  personal  Injury  or  aircraft  damage  resulting  from  an  unsafe  condition.  | 

Neither  does  the  concept  consider  ejection  capability,  parachutes,  life  rafts,  etc. , | 

which  do  not  make  an  aircraft  safer  per  se  but  provide  for  the  survivability  of  the  air- 
crew when  the  aircraft  is  unsafe.  Collision  is  also  excluded  from  consideration 
because  of  the  complexity  of  the  interrelationships  between  pilot,  aircraft  equipment, 
ground  surveillance,  and  traffic  density. 

2.2  MATHEMATICAL  BASIS  OF  FSPT 

The  probability  of  an  accident  caused  by  the  failure  of  an  element  can  be  i 

expressed  as  the  probability  of  the  element  failing  multiplied  by  the  conditional  prob-  t 

ability  that  the  failure  of  the  element  will  cause  an  accident.  Stated  in  equation  form: 


P(/f.j)  = Pa)P(./f|j)  (1) 

where 

P(./f  »J)  = Probability  of  an  accident  due  to  failure  of  just  the  j^^  element* 

P(j)  = Probability  that  element  j falls 

P(^  I J)  = Probability  of  an  accident  given  that  the  j*"*^  element  falls. 

This  equation  reflects  the  basic  relationships  addressed  in  the  FSPT  where: 

a.  The  criticality  of  the  j^^  element  is  an  estimate  of  P(./f , j) 

b.  The  sensitivity  of  the  j^h  element  is  an  estimate  of  P(  /?  j j) 

*In  this  and  subsequent  discussions,  unless  otherwise  stated,  expressions  sueh  as 
"failure  of  the  Jfh  element"  should  be  Interpreted  to  mean:  failure  of  only  the  jth 
element,  assuming  all  other  elements  are  not  failed. 
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Because  an  element's  effect  on  safety  may  depend  on  the  mission  phase  (see 
Section  3.2.1),  the  above  model  can  be  expanded  to: 


N 

1^1 


(2) 


where 


N 

P(>f|J.k) 


Number  of  mission  phases 

Probability  that  the  clement  is  failed  in  the  phase 
The  jtk  element's  sensitivity  in  the  k^h  phase. 


To  Identify  the  importance  of  discrete  elements  to  aircraft  safety,  a flight 
profile  consisting  of  nine  distinct  phases  was  defined.  The  phases  are  discussed  in 
Section  3.2. 1. 

To  utilize  equation  2,  it  was  necessary  to  develop  a method  for  obtaining  the 
values  of  P(4 1 j,k),  the  probability  that  a malfunction  in  element  j during  mission 
phase  k will  result  In  an  accident.  This  method  in  turn  requires  the  estimation  of  two 
parameters:  the  probability  of  accident  if  a major  function  is  not  available  during 
each  mission  phase,  and  the  dependence  of  the  major  function  on  subfunctions  and 
elements  during  each  such  phase*.  Each  function  and  equipment  item  thus  derives 
its  sensitivity  value  from  its  relationship  to  the  major  function(s)  dependent  upon  it. 

2. 3 SENSITIVITY  ASSIGNMENTS 


A great  deal  of  Information  is  available  on  the  causes  of  aircraft  accidents,  but 
little  exists  from  which  to  make  the  sensitivity  assignments  [P(-4|  j)].  These  assign- 
ments are  therefore  largely  subjective,  based  on  the  analyst's  knowledge  of  the  system 
and  any  information  he  may  have  on  previous  accident  history.  The  sensitivity 
assigments  are  reviewed  (and  revised  as  necessary)  by  an  Air  Force/contractor  team 
working  on  a particular  model  to  ensure  that  consistent  criteria  have  been  followed. 
The  team  review  and  negotiation  of  sensitivity  assignments  is  the  mechanism  by  which 
the  value  becomes  sufficiently  objective  for  use  with  the  model.  This  negotiation  con- 
siders all  of  those  top  level  functions  as  a group  and  reassigns  sensitivity  values  as 
necessary  to  assure  that  the  most  objective  proportionality  is  attained  for  the  par- 
ticular aircraft  model.  The  same  major-function  sensitivity  values  are  used  for 
major  functions  on  all  aircraft  models  where  configuration  and  mission  profiles 
permit. 


The  development  of  criticality  rankings  for  the  various  elements  (j's)  is 
dependent  upon  the  ability  to  quantify  the  failure  probability  [P(j)]  and  the  clement 
sensitivity  (P(>f(  j)]  for  each  element.  Since  the  Intent  of  the  concept  is  to  provide  a 
relative  safety  ranking  of  all  malfunctions,  it  is  not  necessary  to  develop  absolute 


*For  a more  deialled  discussion  of  the  mathematics  of  the  FSPT,  see  Appendix  B. 
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values  for  P(.>f|  j).  If  the  sensitivity  values  (iovclopcd  are  correct  relative  to  each 
other,  a proper  criticality  rankinR  will  be  established.  It  is  intended  that  criticality 
be  an  index  proportional  to  P(  4,j)  find  therefore  provide  the  same  relative  rank 
ordering  of  elements.  The  major  reasons  for  proportionality,  rather  than  (‘quality, 
are: 

a.  The  FSPT  does  not  account  for  the  effect  of  extraordinary  pilot 
Intervention  to  prevent  an  accident  in  case  of  equipment  malfunction. 

b.  Criticality  quantification  was  limited  in  its  treatment  of  simultaneous 
occurrence  of  independent,  primary  failures. 


1 

i 


c 

i: 

0 


c.  Operational  and  malfunction  data  yield  only  a proportional  estimate  of 
the  required  Information. 

While  strict  proportionality  cannot  be  mathematically  proven,  it  is  believed  that 
the  criticality  rankings  provide  reasonable  relative  measures  of  equipment  problem 
potential. 
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MODEL  DEVELOPMENT 


Figure  3-1  summarizes  the  approach  to  the  assessment  of  flight-safety 
criticality  of  aircraft  equipment.  The  first  contractor  activity  is  the  identification  of 
all  functions  the  aircraft  is  expected  to  perform  and  the  determination  of  their  inter- 
relationships. Next,  each  functional  relationship  is  documented;  and  then  sensitivity 
assignments  are  made  at  the  major  functional  levels  (below  these  levels,  link 
dependency  values  are  estimated;  see  discussion.  Section  3,2.2).  This  process  is 
carried  out  until  each  work  unit  code  associated  with  a major  function  has  been  identi- 
fied with  respect  to  the  function  performed  and  dependencies  have  been  estimated. 
Computer  processing  calculates  the  safety  sensitivity  for  each  work  unit  coded  item, 
combines  these  values  with  the  operation  and  failure  data  input  by  the  Air  Force,  and 
produces  the  equipment  criticality  ranking. 


Figure  3-1.  Activities  and  Data  Inputs  to  Flight  Safety  Criticality  Assessment 


The  steps  In  this  process  are  discussed  in  greater  detail  in  the  following 
sections. 


* * 3.1  FUNCTIONAL  ANALYSIS 

Functional  analysis  entails  the  systematic  identification  of  the  relationships  of 
hardware  to  the  functions  performed  by  the  aircraft  and  documented  in  the  aircraft 
technical  orders.  Tabulated  for  each  aircraft  function  are  the  equipments  necessary 

* ’ for  its  performance  as  well  as  all  outputs  required  for  other  systems.  The  complexity 

of  the  functional  interdependencies  of  an  aircraft  requires  the  use  of  a systematic 


L. 
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accounting  procedure,  as  discussed  below,  to  assure  that  all  relationships  have  been 
identified  and  that  no  functional  paths  have  been  overlooked. 


r 


Certain  top-level  functions  (comprised  of  both  "primary"  and  "major"  functions) 
have  been  defined  as  applicable  to  all  aircraft  types,  and  s(‘rve  as  the  starting  point 
for  a safety  analysis.  Figure  3-2  lists  these  top  level  functions  with  the  primary  funt.- 
tion  of  Flight  Control  expanded  to  show  its  typical  major  (unctions.  Below  the  major 
function  level,  differences  in  aircraft  types  result  in  function  idcmtification  and  struc- 
turing specifically  suited  to  each  aircraft.  In  Figure  3-2,  for  instance,  the  major 
function  Roll  Control  is  subdivided  into  Left  Roll  and  Right  Roll,  and  further  into 
aileron  and  spoiler  actuation  subfunctions.  This  structure  is  that  applicable  to  an  F-  I 
aircraft,  in  which  ailerons  have  an  extremely  limited  upward  travel  and  lift  is  pri- 
marily lost  through  spoiler  operation.  Finally,  each  item  in  the  aircraft  WUC  ("-0<;") 
manual  Is  identified  with  respect  to  the  function  it  performs.  ♦ 

Every  function  and  every  WUC  included  in  the  model  receives  an  "alpha 
designator"  unique  to  that  aircraft  model.  Due  to  the  largo  number  of  alpha  desig- 
nators required  in  a model,  an  indenturing  system  is  utilized  to  prevent  duplication. 
However,  the  location  in  the  hierarchal  structure  and  the  number  of  characters  in  the 
alpha  designators  are  often  independent,  since  such  correlation  is  not  necessary  for 
subsequent  computer  processing. 

The  functional  relationships  from  the  system  diagram,  and  identification  of  the 
equipment  necessary  for  each  function,  are  next  documented  in  an  80-column  punch- 
card  format  (see  Appendix  C).  The  total  functional  diagram  for  the  aircraft  is  then  a 
compilation  of  the  system  diagrams,  with  one  punchcard  for  each  functional  link. 

With  the  aircraft’ functions  completely  documented,  the  functional  paths  by  which 
a piece  of  equipment  contributes  to  the  operation  of  the  aircraft  can  be  identified  by 
computer.  Performing  the  path-identification/documentation  task  by  computer  proves 
to  be  not  only  useful  but  necessary  — the  human  analyst  could  neither  keep  track  of  nor 
assign  sensitivity  values  to  all  functional  paths.  The  machine  processing  capability 
allows  the  analyst  to  consider  only  one  functional  link  at  a time.  The  ability  to  follow 
all  of  the  functional  interrelationships  within  the  aircraft,  which  is  necessary  for 
meaningful  assessment  of  safety,  is  then  provided  by  the  computer. 


3.  2 MAJOR-FUNCTION  SENSITIVITY  ASSIGNMENT 
3.2.1  Assignment  Method 

As  stated  earlier,  the  sensitivity  of  a function  or  equipment  item  is  an  estimate 
of  the  probability  that  its  failure  will  cause  an  accident.  From  functional  analysis  of 
the  aircraft  under  consideration,  major  functions  are  identified  and  are  assigned 
sensitivity  values  for  each  phase  of  the  mission. 


♦Certain  WUC  items  in  the  "-06"  manual  may  not  be  included  in  the  safety  model, 
these  items  being  either  1)  eliminated  by  TCTOs;  2)  purely  structural  items  in  the 
11000  series;  3)  necessary  only  for  survivability  or  ejection;  4)  of  lower  indenture 
than  the  LRU  level,  where  computer  data  screening  eliminates  failure  reports. 
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Figure  3-2.  Hierarchical  Structure  of  Aircraft  Functions 


The  relative  importance  of  primary  functions,  major  functions,  and  functions  is 
not  necessarily  constant  throughout  a flight.  The  failure,  for  example,  of  one  englnt; 
of  a multi-engine  aircraft  is  far  more  critical  on  takeoff  than  it  is  during  the  rest  of 
the  flight,  and  is  of  relatively  little  Importance  during  startup  and  taxi.  To  accommo- 
date this  variability  of  importance,  the  mission  of  an  aircraft  is  divided  into  nine  flight 


phases: 

1. 

Startup  and  taxi 

2. 

Takeoff 

3. 

Ascend  (climb-out) 

4. 

Cruise,  outbound 

5. 

Intercept  or  tactical  phase 

6. 

Cruise,  inbound 

7. 

Descend 

8. 

Land 

9. 

Taxi  and  shutdown 

These  phases  are  Illustrated  in  Figure  3-3. 
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A sensitivity  value  is  assigned  for  each  of  the  phases,  and  represents  the  best 
estimate  of  the  likelihood  that  the  aircraft  will  enter  a ha/.ardous  mode  if  the  function 
is  not  present  in  that  phase.  The  numerical  values  assigned  are  proportional  rather 
than  absolute,  and  range  from  0.0  to  1.0.  The  keypunch  card  format  limits  this 
assignment  to  increments  of  0. 1.  Increments  smaller  than  0. 1,  when  rc*quired,  were 
assigned  by  defining  a quasi-function  for  insertion  between  the  major  function  and  its 
dependent  primary  function. 

3.2.2  Link  Dependency  Assignment 

"Link  dependency"  is  defined  as  the  probability  that  the  loss  of  a function  will 
result  in  the  loss  of  a dependent  function.  (For  a more  detailed  discussion  of  this 
term,  see  Appendix  B.)  The  assignment  of  link  dependency  values  requires  knowledge 
of  the  operation  of  specific  aircraft  because  it  is  concerned  only  with  functional  levels 
below  the  "major"  category.  At  this  lower  level,  no  evaluation  is  made  of  the  impact 
on  flight  safety  of  the  loss  of  functions.  Instead,  the  effect  of  the  loss  of  one  function 
on  the  performance  of  another  function  becomes  the  evaluation  criterion.  Like 
sensitivities,  link  dependency  values  are  assigned  in  Increments  of  0. 1.  Additionally, 
the  method  of  attenuation  used  in  assigning  sensitivity  values  can  also  be  applied  to 
link  dependencies. 

3.2.3  Provisory  Factors 

The  sensitivity  of  major  functions  with  respect  to  aircraft  safety,  and  at  the 
lower  levels  the  link  dependency  between  functions,  can  be  dependent  on  external 
Influences  and  aircraft  operating  conditions.  To  accommodate  these  external  influ- 
ences, a set  of  provisory  factors  has  been  identified.  An  example  would  be  a wind- 
shield anti-ice  system,  which  has  a safety  sensitivity  close  to  1.0  during  landing 
under  icing  conditions  but  a negligible  effect  on  a dry,  warm  day. 

Under  such  circumstances,  the  procedure  is  to  assign  the  "worst  case"  value 
(assuming  the  condition  exists).  During  model  exercise  the  likelihood  that  the  condi- 
tion exists  can  be  "read-in",  thereby  allowing  the  sensitivity  value  to  be  assigned  by 
the  computer  based  on  the  likelihood  of  the  condition  and  the  probability  that  the  higher 
level  function  will  therefore  be  lost.  Table  3-1  lists  the  standard  provisory  factors 
used  in  FSPT  models. 

3.2.4  Computer  Processing 

Documentation  of  a flight  safety  analysis  by  ARINC  Research  thus  consists  of 
functional  diagrams,  coded  functional  tabulations,  a functional  data  processing  card 
deck,  and  a machine-prepared  printout  of  the  card  deck  data.  Under  this  contract, 
the  documentation  is  then  sent  to  San  Antonio  Air  Logistics  Center  for  review  by 
MMER  personnel  and  representatives  of  the  Air  Logistics  Center  responsible  for  the 
particular  aircraft  (if  other  than  SA/ALC). 

SA/ALC  processes  the  functional  data  card  deck  utilizing  a number  of  com- 
puterized operations.  First,  a functional  deck  edit  is  accomplished  to  identify  certain 
format  or  logic  errors  that  may  exist.  Next,  a path  Identification/documentation  run 
is  made  that  traces  all  possible  paths  associated  with  each  function  and  calculates  the 
numerical  sensitivities  by  flight  phase  down  to  the  WUC  level.  Then,  a path  combi- 
nation run  is  made  taking  into  account  the  dependence  of  more  than  one  major  function 
on  a particular  WUC.  Finally,  failure  Information  from  the  66-1  data  system  and 
numerical  factors  for  provisory  conditions  are  input  and  a WUC  criticality  list  by  rank 
order  is  generated  by  the  computer. 
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TABLE  3-1.  PROVISOnY  FACTOR  CODES 


Provisory  Condition 


Iclns  conditions 

Adverse  spced/altitude  operations 

Runway  stopping  distance/confined  area  (Helicopter) 

Night  operation 

IFR  conditions 

Supersonic  flight 


Solo  flight 

Loss  of  function  for  which  indication  is  provided 
Normal  system  failed 


Flame-out 


Cold  weather 


One  of  three  available  units  is  required 
Two  of  three  available  units  are  required 
One  of  four  available  units  is  required 
Two  of  four  available  units  are  required 
Three  of  four  available  units  are  required 
Four  of  eight  available  units  are  required 
Four  of  six  available  units  are  required. 
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An  additional  product  Ronerated  by  the  computer  is  a two-part  criticality  trend 
analysis.  Part  I contains  the  criticality  rankinRs  and  linear  reRression  analysis  by 
WUC  for  the  previous  12  months.  Part  II  contains  plots  of  the  criticalities  and 
rcRression  lines  for  the  25  WUCs  top-ranked  accordinR  to  safety  criticality. 

3.2,5  Model  Maintenance 

Each  time  an  aircraft  type  for  which  a safety  model  has  been  developed  unrlcr- 
Roes  a modification,  the  effects  of  the  chanRes  on  the  model  must  be  evaluated.  Tech- 
nical order  and  WUC  revisions  must  be  incorporated  into  the  model.  Removal  of 
existing  hardware,  the  Installation  of  new  hardware,  or  desiRn  improvements  may 
change  link  dependencies  and  sensitivity  assignments.  The  update  procedure  should 
follow  the  same  general  steps  as  outlined  for  the  initial  analysis  effort. 

Existing  block  diagrams  and  a printout  of  the  functional  card  deck  form  the 
baseline  for  change  identification.  Functional  relationships  should  be  reviewed  to 
determine  the  Impact  of  changes  on  the  documented  safety  analysis.  Diagrams  should 
be  revised  to  reflect  functional  differences,  WUC  changes  should  be  noted,  and  all 
differences  listed  on  a flight-safety  functional  tabulation  sheet.  The  functional  dock 
printout  can  be  used  for  manual  Indication  of  what  the  changes  are  and  where  they 
occur.  New  data  cards  are  prepared  and  the  functional  deck  updated  by  the  removal 
of  obsolete  cards  and  the  insertion  of  new  cards.  From  this  point  on,  the  computer 
is  again  utilized  to  edit  the  functional  deck,  perform  path  identification/documentation, 
and  calculate  sensitivities  for  each  WUC. 

Block  diagrams  and  other  affected  portions  of  the  spe'ific  aircraft  safety 
analysis  report  should  be  updated  and  revised  pages  issued  that  reflect  these  changes. 
Maintaining  an  accurate  and  updated  model  is  important  to  obtaining  an  accurate 
assessment  of  the  safety  significance  of  hardware  failures. 
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B-52G  AND  B-52H  MODEL  DEVELOPMENT 


■ 1 

The  FSPT  models  for  the  B-52G  and  B-52H  aircraft  were  developed  concurrently. 

Model  development  was  initiated  in  May  1974,  and  the  systems  modeled  in  accordance 
with  the  contract  modification  of  June  1973  were  submitted  for  "G09!j"  computer  edit 
at  SA/ALC  in  August  1974. 

The  aircraft  flight  manual  and  maintenance  technical  orders  provided  the  infor- 
mation on  aircraft  system  operation.  The  model  developed  represents  the  B-52G  and 
B-52H  aircraft  configured  to  the  latest  time  compliance  technical  orders  (TCTOs) 
documented  in  the  manuals  supplied  by  SA/ALC.  Tables  4-1  and  4-2  list  the  manuals 
and  their  revision  status  applicable  to  the  developed  model. 

In  March  1973,  a seminar  was  conducted  at  the  Oklahoma  City  Air  Logistics 
Center  (OC/ALC)  by  representatives  of  SA/ALC  and  ARINC  Research  to  familiarize 
OC/ALC  personnel  with  modeling  requirements  and  techniques  for  their  participation 
in  the  B-52  and  A-7D  modeling  efforts. 

The  modeling  of  the  B-52  fuel  system  required  the  use  of  a new  provisory  factor 
to  accommodate  the  partial  redundancy  situation  unique  to  this  aircraft.  The  partial 
redundancy  provisory  factor,  used  with  each  of  the  eight  engines,  w’as  coded  "8"  to 
Indicate  that  any  four  of  the  eight  engines  were  needed.  The  fuel  for  any  of  the  four 
nacelles  is  common  for  both  engines  in  that  nacelle.  Therefore,  the  loss  of  fuel  to 
any  nacelle  would  result  in  loss  of  two  engines.  To  accommodate  this,  a provisory 
factor  coded  ”9"  was  introduced  to  mean  that  if  any  three  or  more  of  the  engines  on 
the  remaining  three  nacelles  have  failed,  then  the  fuel  to  the  subject  nacelle  is 
required  for  the  safety  of  the  aircraft. 

A single  functional  documentation  deck  having  "52"  in  columns  1,  2 was  used  for 
the  two  versions  of  the  B-52  aircraft.  Cards  having  a blank  in  column  3 are  common 
to  both  aircraft.  When  the  common  cards  are  combined  with  those  having  a "G"  in 
column  3,  the  resulting  deck  documents  the  B-52G.  Similarly  the  common  cards 
together  with  the  cards  containing  an  "H"  in  column  3 document  the  B-52H  aircraft. 

The  B-52G  and  B-52H  safety  models  were  developed  by  AlUNC  Research  for  all 
systems  except  the  landing  gear.  The  landing  gear  diagram  and  functional  documen- 
tation cards  were  produced  by  MMER/OC/ALC,  and  interface  documentation  for  the 
landing  gear  was  a joint  effort  by  OC/ALC  and  ARINC  Research. 

Because  of  the  vulnerability  of  the  functional  loglc/sensltlvity  documentation  to 
such  errors  as  omission  of  links,  duplication  of  cards,  and  keypunching,  quality 
reviews  were  conducted  at  various  critical  points  in  the  model  development.  In  addi- 
tion to  keypunch  verification,  each  card  was  checked  against  the  functional  link  shown 
on  the  original  rough  draft  and  the  final  functional  diagram  and  the  diagrammed  link 
was  checked  off.  Missing  or  duplicated  functional  links  were  thus  identified.  Work 
unit  codes  used  in  the  model  were  checked  off  against  the  WUC  manual  to  assure 
completeness. 
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The  quality  reviews  were  first  conducted  by  the  organizations  responsible  for  |l 

the  subsystems  prior  to  merging  and  computer  verification  of  the  respective  aircraft 
decks  by  SA/ALC.  Following  the  merging  of  the  Air  Force/A  RING  Research  decks 
and  computer  verification  at  SA/ALC,  a second  quality  review  was  performed  by  rep- 
resentatives of  ARINC  Research  and  OC/ALC.  Finally,  the  first  criticality  printout 
obtained  from  anpUcatlon  of  actual  aircraft  data  was  reviewed  to  Identify  any  items 
whose  sensitivity  appeared  to  be  unreasonable.  In  such  cases  the  paths  were  traced 
manually  and  changes  made  if  an  erroneous  relationship  was  found. 

Appendix  C presents  the  methods  and  standards  used  In  documentatlng  an  FSPT 
aircraft  model.  Appendix  D presents  the  FSPT  documentation  for  the  B-52G  and 
B-52H  aircraft,  which  covers  both  the  OC/ALC  and  ARINC  Research  portion  of  the 
model. 


TABLE  4-1.  B-52G  SYSTEM  DOCUMENTATION 


Publication  No. 

Title 

Revision/Date 

1B-52G-1 

Flight  Manual 

Change  24,  15  May  1972 

1B-52B-2-1 

General  Airplane 

Change  35,  20  Aug  1973 

1B-52G-2-2 

Ground  Handling,  Servicing  and  Air- 
frame Maintenance 

Change  50,  10  Oct  1973 

1B-52G-2-3 

Utility  Systems 

Change  34,  15  Sep  1973 

1B-52F-2-4 

Power  Plant 

Change  24,  15  Jul  1973 

1B-52G-2-8 

Fuel  System 

Change  27,  15  Oct  1973 

1B-52G-2-10 

Landing  Gear 

Change  36,  15  Nov  1973 

1B-52B-2-11 

Flight  Controls 

Change  35,  20  Oct  1973 

1B-52G-2-11 

Instruments 

Change  50,  15  Nov  1973 

1B-52G-2-12 

Electrical  Systems 

Change  52,  1 Nov  1973 

1B-52B-2-14 

Hydraulic  Systems 

Change  43,  1 Dec  1973 

1B-52G-2-14 

Airplane  System  Wiring  Diagrams 
and  Data 

Change  9,  15  Sep  1972 

1B-52G-2-20 

Electronic  Warfare  Systems 

Change  37,  15  Mar  1973 

1B-52G-2-22 

Fire  Control  Systems 

Change  43,  1 Aug  1973 

1B-52B-2-24 

Electronic  Communication  System 

Change  41,  30  Jun  1973 

1B-52B-2-25 

Electronic  Navigation/Recognition 
Systems 

Change  57,  15  Jul  1973 
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TABLE  4-1.  (Cont) 


Publication  No. 

Title 

Revision/Date 

1B-52B-2-2G 

Compass  Systems 

Change  37,  1 Sep  1973 

1B-52G-2-26 

Bombing-Navigational  System 

Change  1,  1 Dec  1973 

1B-52B-2-27 

Autopilot  and  Automatic  Flight  Control 
System 

Change  31,  15  Nov  1973 

1B-52B-2-30 

Camera  Systems 

Change  31,  1 Apr  1973 

1B-52B-2-31 

Bomb  Release  Systems 

Change  33,  31  Jul  1973 

1B-52C-2-36 

Automatic  Astrocompass 

Change  16,  30  Mar  1973 

1B-52G-2-40 

Stability  Augmentation  System 

Change  11,  1 Dec  1973 

1B-52B-06 

Work  Unit  Code  Manual 

Change  2,  1 Jan  1974 

TABLE  4-2.  B-52H  SYSTEM  DOCUMENTATION 


Publication  No. 

Title 

Revision/Date 

1B-52H-1 

Flight  Manual 

Change  23,  14  May  1972 

1B-52B-2-1 

General  Airplane 

Change  35,  20  Aug  1973 

1B-52G-2-2 

Ground  Handling,  Servicing  and  Air- 
frame Maintenance 

Change  50,  10  Oct  1973 

1B-52G-2-3 

Utility  Systems 

Change  34,  15  Sep  1973 

1B-52H-2-7 

Power  Plant 

Change  25,  15  Nov  1973 

1B-52G-2-8 

Fuel  System 

Change  27,  15  Oct  1973 

1B-52B-2-10 

Landing  Gear 

Change  36,  15  Nov  1973 

1B-52B-2-11 

Flight  Controls 

Change  35,  20  Oct  1973 

1B-52G-2-11 

Instruments 

Change  50,  15  Nov  1973 

1B-52G-2-12 

Electrical  Systems 

Change  52,  1 Nov  1973 

1B-52B-2-14 

Hydraulic  Systems 

Change  43,  1 Dec  1973 

1B-52G-2-14 

Airplane  System  Wiring  Diagrams 
and  Data 

Change  9,  15  Sep  1972 
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Publication  No. 

TUlo 

Itevlslon/Date 

in-r>2G-2-20 

Kloctronlo  Warfare  Systems 

Chnn^e  37,  15  Mar  1973 

in-r.2n-2-22 

Fire  Control  System 

CbnnKc  2S,  1 Sep  1973 

in-r)2B-2-24 

lUectronle  Communication  Systems 

Change  11,  30  Jun  1973 

in-r>2n-2-2r) 

Kloctronle  NavlRntlon/Hecofinltlon 
Systems 

Change  57,  15  Sep  1973 

in-r)2n-2-2fi 

Compess  Systems 

Chanfje  37,  1 Sep  1973 

in-r)2r,-2-2fi 

BomblnK-Navluatlonal  System 

Change  1,  1 Dec  1973 

lB-r)2B-2-27 

Autopilot  and  Automatic  Flight  Control 
System 

Change  31,  15  Nov  1973 

in-r)2B-2-3o 

Camera  Systems 

ChanRe  31,  1 Apr  1973 

in-r>2n-2-3i 

Bomb  Uelease  Systems 

ChanRe  33,  31  ,Iul  1973 

in-r)2c-2-3f. 

Automatic  Astrocompass 

ChanRe  10,  30  Mar  1973 

111-520-2-10 

Stability  Augmentation  System 

ChanRe  11,  1 llec  1973 

in-52B-or) 

Work  Unit  Code  Manual 

ChanRe  2,  1 Jan  1971 

APPENDIX  A 

HISTORICAL  SUMMARY  OF  FSPT 
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HISTORICAL  SUMMARY  OF  FSUT 

In  1965,  the  desirability  and  practicability  of  quantifylnp  the  sipnlficance  of 
specific  equipment  malfunctions  relative  to  flluht  safety  was  explored  in  a feasibility 
study  conducted  by  ARINC  Research  Corporation  for  the  Air  Force.  The  feasibility 
of  a safety-quantification  approach,  which  has  subsequently  become  known  as  Flight 
Safety  Prediction  Technique  (FSPT),  was  demonstrated;  and  the  method  was  develop(*d 
and  refined  in  a series  of  studies,  as  follows; 

Study 

Phase  Subject/Date  Sponsor*/Publication  No. 

I Feasibility  Study,  Sacramento  Air  Materiel  Area  (SMNK), 

September  1965  to  Contract  AF09(603)623.‘I5,  SM-67-2; 

June  1967  (Phase  I)  publication  705-01-1-777 

II-A  Technique  Development,  San  Antonio  Air  Materiel  Area  (SANFW), 

October  1967  to  Contract  AF09(603)-67-A-0267-SA01; 

July  1968  (Phase  II-A)  publication  734-01-1-895 

n-B  Technique  Development,  San  Antonio  Air  Materiel  Area  (SANFW), 

July  1968  to  July  1969  Contract  F09(603)-68-A-0317-SA01; 
(Phase  II-B)  publication  754-01-1-985  (Revision  1) 

FSPT  System  Documen-  San  Antonio  Air  Materiel  Area  (MMKR) 
tation  for  the  F-4C  and  Contract  F41608-71-C-0576; 

T-37  Aircraft,  October  publication  697-01-1-1118 

1970  to  June  1971 

In  the  Phase  n-B  study,  the  FSPT  was  applied  to  the  F-106  aircraft.  Con- 
current with  Phase  II-B,  the  U.S.  Naval  Safety  Center  contracted  ARINC  Research  to 
extend  the  methodology  to  produce  a flight  safety  criticality  model  for  the  F-4J  air- 
craft. The  results  of  this  effort  are  documented  in  ARINC  Research  Publication 
753-01-3-982  (Revision  1). 

In  1970,  ARINC  Research  was  contracted  to  develop  suitable  input  data  to  per- 
mit the  application  of  the  technique  to  the  T-37  and  F-4C  aircraft.  These  data  were 
derived  in  the  form  of  mathematical  model  functional  documentation  as  input  to  the 
basic  computer  program  developed  and  applied  to  the  F-106. 

In  1972,  ARINC  Research  Corporation  was  awarded  a contract,  with  the  sub- 
sequent modlflcations  in  1973  and  1974,  to  apply  the  Flight  Safety  Prediction 
Technique  to  15  aircraft,  working  jointly  with  cognizant  Air  Logistics  Centers.  Air- 
craft to  which  the  FSPT  has  been  applied  under  this  latter  contract  (F09603-72-A- 
1132-SAOl)  include: 

a.  T-38 

b.  F-lllA  and  FB-lllA 


♦The  office  symbols  of  Service  Engineering  at  the  Sacramento  and  San  Antonio  Air 
Materiel  Areas  are  now  SM/ALC/MME  and  SA/ALC/MME,  respectively. 
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g.  0-2 

h.  OV-10 

1.  B-52G,  H 

j.  C-130E 

k.  KC-135 

l.  C-5A 

m.  T-39 

n.  F-15 

o.  UH-IN  Helicopter* 
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FORMULATION  OF  CRITICALITY-ASSESSMENT  TECHNIQUE 


To  implement  the  basic  safety  model  defined  in  Section  2. 2,  it  is  necessary  to 
develop  a submodel  for  the  probability  that  a malfunction  in  element  j during  mission 
phase  k will  result  in  an  accident.  This  submodel  in  turn  requires  that  we  estimate 
two  parameters:  the  probability  of  accident  if  a major  function  is  not  available  during 
each  mission  phase,  and  the  dependence  of  the  major  function  on  element  j during  each 
mission  phase. 

The  first  parameter  is  termed  "functional  sensitivity"  and  is  estimated  for  each 
major  function.  The  fimctional  analysis  performed  in  this  task  established  for  an 
aircraft  the  following  hierarchal  scheme: 

Aircraft 

Primary  functions 

Major  functions 

Function 

Elements  (Work  Unit  Codes) 

A primary  function  would  be  one  such  as  Flight  Control.  Major  functions  under 
Flight  Control  would  include  Pitch  Control  and  Yaw  Control. 

The  second  parameter,  "link  dependency,"  is  a vehicle  for  showing  the  influ- 
ence of  each  functional-path  element  on  the  performance  of  a major  function.  For 
example,  if  the  major  function  being  considered  is  External  Lighting,  the  following 
diagram  illustrates  the  nature  of  functional  sensitivity  and  link  dependency  values. 


* Link  dependencies 
'''Functional  sensitivity 


The  0. 8 value  means  that  failure  of  the  Control  function  will  result  in  loss  of  the 
Landing  Light  function  80%  of  the  time.  The  0. 1 functional  sensitivity  value  denotes 
that  loss  of  external  lighting  will  result  in  an  accident  10%  of  the  time.  The  values 
must  be  interpreted  in  a proportional  sense.  In  that  the  actual  accident  probability  is 
dependent  upon  external  factors  (see  Section  3.2.3). 
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The  remainder  of  this  appendix  discusses  the  procedures  and  model  used  to 
obtain  element  aensltlvltles;  e.g. , in  the  above  example,  the  accident  probability 
given  that  a Work  Unit  Code  in  the  Control  function  malfunctions. 

Three  principal  types  of  functional  relationship — series,  redundant,  and 
parallel— were  identified  as  representing  the  major  forms  to  consider  in  modeling 
element  sensitivity . 

Series  Relationship  — A function  having  only  one  input.  Schematically, 


A 

B 

which  Indicates  that  outside  of  its  own  elements,  the  success  of  function  B is  only 
affected  by  the  success  of  function  A. 

Functional  Redundancy  — A function  having  one  or  mo  re  backup  functions  that 
can  provide  the  required  inputs  to  successor  functions.  Schematically, 


where  Ai  and  A2  represent  a functional  redundancy  in  that  either  may  provide  the 
necessary  input  to  B. 

Parallel  Functions  — Two  or  more  functions  independent  of  each  other  in  terms 
of  functional  success,  but  each  of  which  may  be  required  for  a successor  function. 
Schematically, 


B will  generally  require  both  Aj  and  A2  ; but  Aj  does  not  depend  on  A2  . nor  does 
Ao  depend  on  A^  . 

In  some  cases  the  distinction  between  functional  redundancy  and  parallel  paths 
is  very  slight,  and  may  depend  on  mission  phase.  Tor  example  the  four  engines  of  a 
plane  can  be  considered  to  be  a redundant  configuration  providing  inputs  to  the  pri- 
mary propulsion  function  during  cruising,  but  would  generally  be  considered  to  be 
parallel  functions  during  takeoffs  requiring  full  power. 
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In  general,  given  a schematic  relationship  of  the  form. 


1 


we  can  say  that  A and  B are  in  a functionally  redundant  configuration  if  the  success 
probabilify  of  C is  the  same  if  1)  A and  B are  successful,  2)  A only  is  successful, 
or  3)  B only  is  successful.  If,  for  example,  C is  more  likely  to  be  successful  if  both 
A and  B are  successful,  rather  than  A or  B alone,  then  the  relationship  Is  one  of 
parallel  paths. 

It  is  noted  that  the  model  will jalso  account  for  element  redundance  and  parallel 
elements  through  Inputs  such  as  P(A|lg),  representing  the  probability  that  the  Ath 
function  falls  given  that  the  ig^"  element  in  A has  failed.  If  Ig  is  a parallel  element, 
the  probability  would  depend  on  mission  requirements  and  other  parallel-element 
states. 

Link  dependency  is  the  conditional  probability  of  a functional  failure,  given  the 
failure  of  immediate  predecessor  functions.  The  link  dependencies  applicable  to  the 
three  basic  designs  defined  above  are  shown  below. 


Link  dependency  = P(B|A)  = probability  that  B fails  given  that  A fails. 


wh«re  1 = V2 

Parallel  Functions 


We  shall  generally  assume  that  the  dependencies  of  with  respect  to  A , and  of 
B2  with  respect  to  A . are  independent  of  each  other,  so  that 


■ PfBjiAlPfBolA) 


We  then  can  consider  three  link  dependencies  from  A to  B as  follows: 


t 


noting  that 

P(Bj|A)  P(BjB2|A)  + P(Bjn2|A) 

P(B2|A)  - P(BjB2|X)  + P(BjB2|A) 

Models  are  shown  below  for  determining  the  sensitivity  of  elements  within  a 
function  for  each  of  the  three  basic  designs.  The  following  basic  assumptions  apply: 

a.  Except  for  cases  where  an  element  has  a redundant  or  parallel  counterpart 
or  is  located  in  a function  with  a redundant  or  parallel  function,  only  the 
element  under  consideration  shall  be  assumed  to  have  failed  initially.  Thus 
the  expression  P(/f|ia).  representing  the  accident  probability  given  failure 
of  the  l^  Work  Unit  Code  element,  is  based  on  the  assumption  that  no  other 
element  has  failed  unless  element  I is  in  some  redundant  or  parallel  con- 
figuration. For  cases  in  which  there  are  redundant  or  parallel  counter- 
parts, failures  of  such  counterpart  elements  or  functions  are  considered  in 
accordance  with  their  occurrence  probabilities. 

b.  The  success  of  all  immediate  predecessors  ensures  the  success  of  a func- 
tion, provided  that  the  function  experiences  no  element  failures.  Thus  for 
the  series  function  relationship 


we  assume 

P(bIa)  0, 

provided  B experiences  no  element  failures.  If  an  element  in  function  A 
is  under  consideration,  the  latter  provision  is  always  true  by  assumption 
"a." 


The  element  sensitivity  models  are: 


Pijtha)  = P(A|la)P(B|A)P(C|B)P(.^lr) 


Functional  Redundancy 


B 


L I 

Pi^llj)  = P(A|ij,)P(B|A)P(ClB)P(wflC) 


Parallel  Functions 


P(^|l  ) = P(A|i„){P(BC|  A)P(l)lBC)  ♦ P(BCiA)P(D|BC) 

3 a 

* P(Bc|a)P(d1bc)}  iMln) 

PUll^j)  = P(Bly {P(C|i^j)P(D|BC)  ► P(C|yP(DlBC)}PWf|D) 
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A case  not  explicitly  incuded  in  the  above  three  basic  functional  relationships  is 
one  for  which  a function  is  in  two  paths,  e.  g. , 


then 


PUlU  = P(C|ijP(B|iJP(^|CB)  4 P(C|i  )P(B|ijP(^|CB) 

3 3 cl  (Id 

+ Piclypdiy  {1  - P(:i|c)P(7lB)} 

where  it  is  assumed  that  the  effects  of  loss  of  the  major  functions  in  accident  occur- 
rence are  independent  of  each  other. 


Use  of  Numerical  Provisory  Factors  for  Partially  Redundant  Systems 

The  numerical  provisory  factors  (see  Table  3-1)  are  used  where  more  than  two 
identical  functions  are  involved  in  a redundancy.  For  example,  aircraft  with  more 
than  two  engines  often  have  identical  and  independent  systems  for  hydraulic  pressuri- 
zation, and  for  electrical  power  generation,  one  driven  by  each  engine.  If  the  aircraft 
can  be  operated  safely  with  one  or  more  of  such  systems  in  a failed  state,  one  of  the 
numeric  codes  is  utilized  in  assigning  link  dependency  values.  Consider,  for  example, 
the  following: 

If  N identical  and  independent  units*  are  available  and  at  least  M are  required 
for  safe  operation,  where  0<M<N,  then  the  provisory  factor  of  a given  unit,  say  I'j,  is 
the  probability  that  the  failure  of  Uj  will  cause  the  aircraft  to  enter  an  unsafe  state. 
This  is  the  probability  that  exactly  M-1  of  the  remaining  N-1  units  will  be  in  an 
unfailed  state.  This  probability  can  be  calculated  by  the  formula  for  the  binomial  dis- 
tribution, and  is  given  by 


-'“i'  “ 

where  P(Uj)  = probability  that  failure  of  the  unit  will  cause  the  aircraft  to  enter 
an  unsafe  state,  and 

M = Number  of  units  required 
N = Number  of  units  available 

p = Probability  that  a single  unit  will  be  in  an  unfalled  state 
q = Probability  that  a single  unit  will  be  in  a failed  state  or  (1-p) 

•Units  may  be  either  elements,  element  assemblies,  or  functions. 
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Assignment  of  link  dependencies  to  N Identical  and  independent  units  of  which 
only  M are  required  proceeds  as  follows.  The  value  assigned  to  each  unit  is  the 
dependency  of  the  higher  level  function  on  receiving  an  output  from  M of  the  units 
(usually  1.0).  The  provisory  factor  is  the  appropriate  numeric  code.  In  the  evaluation 
of  the  path  sensitivity,  the  computer  is  programmed  to  select  the  binomial  formula  that 
corresponds  to  the  provisory  factor  listed. 
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FSPT  noCUMKNTATION  MKTUODS 

Because  of  the  extreme  complexity  of  aircraft,  It  is  necessary  to  develop  a 
computerized  method  to  Identify  and  document  all  possible  paths  associated  with  each 
function  as  well  as  to  determine  the  safety  sensitivity  associated  with  each  path.  A 
computer  routine  has  boon  dovlsed  that  takes  the  data  from  the  functional  card  deck 
and  traces  and  documents  all  paths.  For  each  WUC,  it  also  computes  the  fllKht-phasc 
sensitivities  for  each  path  In  which  the  WUC  is  present.  The  resultlnn  computer 
printout  provides  a combined  hmctlonal  path  sensitivity. 


C.l  ALPHA  CODING 

As  each  system  of  the  aircraft  is  functionally  dlaRrammed,  the  functional  blocks 
are  assigned  an  "alpha  code".  This  code  aids  the  analyst  in  the  Ixiokkeeping  tasks  of 
functional  diagramming  and  provides  the  computer  with  an  identification  of  the  ele- 
ments to  be  processed.  For  standardization  among  aircraft,  nine  top-level  functions 
have  been  defined  and  each  has  been  assigned  an  initial  or  first-alpha  designator. 

Kach  block  In  the  functional  diagram  carries  the  same  initial  alpha  as  the  top  level 
function.  Subsequent  letters  added  to  the  initial  alpha  uniquely  Identify  each  block. 

The  only  restrictions  placed  on  the  assignment  of  alpha  codes  are  that: 

a.  All  characters  In  a code  must  be  a letter  of  the  alphabet,  and 

b.  The  maximum  number  of  characters  In  one  code  Is  seven. 


C.  2 ALPHA  CODING  AND  COMPUTKR  PROGRAM  COMPATIBILITY 

Additional  rules  for  alpha  coding  required  to  obtain  the  desired  results  from 
computer  processing  Include: 

a.  When  a WUC  item  operates  in  the  same  mode  to  perform  more  than  »me 
function,  the  same  alpha  code  is  used  In  each  application. 

b.  When  a WUC  item  operates  in  a different  mode  to  perform  each  of  more 
than  one  function,  a different  alpha  designator  is  assigned  for  each 
operating  mode. 


C.3  FUNCTIONAL  TABUTATION 

The  "Flight  Safety  Functional  Tabulation"  sheet  is  used  to  code  the  safety  model 
for  keypunching.  The  sheets  are  coded  ns  follows  (refer  to  Figure  C-1)  for  an 
example). 


a.  Columns  1 through  3.  Used  to  identify  the  aircraft  rq)re8ented  by  the 
model.  For  certain  aircraft  modeled  under  this  contract  more  than  one 
model  — designation  series  MDS  - was  Included.  For  Instance,  a single 
functional  deck  was  created  for  four  MDSs  of  the  F— i aircraft.  Cards 
with  "F4K"*  in  columns  1-3  were  common  to  all  aircraft.  For  exampb>, 

* blank 


C-3 


Figure  C-1.  Flight  Safety  Functional  Tabulation 


I 


when  these  cards  arc  combined  with  those  carrylnp;  "F4K"  in  columns 
1-3,  then  It  produces  an  F-4E  FSP'*’  model  deck. 

b.  Columns  4 through  31.  Contain  the  title  of  the  function  or  the  WUC  Item. 

c.  Columns  32  through  36.  Contain  the  I eft- justified  WIIC  number. 

d.  Columns  37  and  38.  Blank 

e.  Columns  39  through  46.  Contain  the  assigned  alpha  designator  for  the 
function  and/or  the  WUC.  Column  39  contains  either  an  L or  an  R,  or  is 
blank.  The  L and  R designate  left  and  right  for  those  Instances  when  the 
function  and/or  WUC  pertains  to  the  left  or  right  side  of  the  aircraft. 

f.  Columns  47  and  48.  Blank. 

g.  Columns  49  through  55.  Normally  left  blank,  but  are  used  after  a deck 
is  operational  to  substitute  the  data  on  a card  for  that  stored  in  the  eom- 
puter  by  punching  the  line  record  number  In  this  field. 

h.  Columns  56  through  63.  Identify  the  dependent  functions  for  either 
the  function  or  specific  WUCs  being  coded.  Column  56  may  contain 
L,  R or  blank  for  the  same  purpose  as  that  of  column  39. 

1.  Colunui  64.  Contains  the  alphanumeric  code  of  the  "provisory  factor" 
applicable  to  the  link  value  assigned. 

j.  Columns  65  through  69.  Contain  the  alpha  designator  of  a function  that  is 
an  alternate  for  the  function  being  coded.  (Column  65  Is  used  for  "L"  or 
"R"  as  In  Column  39.)  The  presence  of  the  "alternate  alpha"  flags  the 
Importance  of  the  link  dependency  as  being  affected  by  the  success 
probability  of  the  alternate  function. 

k.  Column  70.  Contains  the  work  unit  code  dependency  value  (1  0.10; 

2 ' 0.20;  ....A  1.0).  This  value  Is  applicable  to  all  flight  phases. 

l.  Column  71.  Contains  special  instructions  to  the  computer  through  the 
use  of  letters  F,  S,  or  being  blank.  Cards  with  an  "S"  or  "blank"  in 
column  71  are  used  in  sensitivity  computations.  Cards  with  an  "F" 
document  a functional  relationships  which,  although  present  in  the  sys- 
tem, would  produce  an  erroneous  sensitivity  value  when  combined  with 
other  nonindependent  paths  (having  the  same  function  in  common  at  some 
higher  level).  The  "F"  prevents  the  computer  from  including  the  link  in 
the  sensitivity  calculations. 

m.  Columns  72  through  80.  Contain  functional  dependencies  for  each  of 
nine  flight  phases  as  described  in  Section  3.2. 1 of  the  text.  Coding  is 
the  same  as  for  column  70. 
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DIAGRAM  CONSTRUCTION 


The  diagrams  produced  under  the  contract  document  the  functional  inter- 
relationship of  the  aircraft  systems  considered  in  the  model.  In  the  Interest  of  extend- 
ing the  useful  life  of  the  diagrams,  WUC  items  are  not  shown,  thereby  eliminating  the 
necessity  of  updating  the  diagrams  with  each  (and  sometimes  frequent)  change  to  the 
WUC  manual. 

As  discussed  earlier  in  this  report,  the  diagrams  represent  the  hierarchal 
structure  of  the  paths  from  whirh  the  sensitivity  values  are  derived.  The  diagrams, 
although  consistent  with  the  system  schematic  and  reliability  block  diagrams,  are  not 
equivalent  due  to  this  hierarchal  method  of  documentation.  In  the  actual  system, 
signals  and/or  fluids  pass  from  one  component  to  the  next  and  are  thus  documented  in 
schematics;  conversely,  the  hierarchal  approach  only  identifies  the  components  that 
must  operate  to  achieve  a given  function,  independent  of  the  direction  and/or  sequence 
of  signal  flow.  This  approach  directly  addresses  the  system  impact  of  a component 
failure  without  the  necessity  of  identif}dng  the  Intrasystem  secondary  failures.  Each 
line  connecting  functions  on  the  diagram  is  documented  by  a punchcard,  with  the  lower 
function  providing  the  "alpha  designator"  and  the  higher  function's  alpha  designator 
indicator  as  the  "dependent  function".  * 


♦The  card  deck  also  documents  functional  relationships  not  shown  on  the  diagram; 
the  work  unit  codes  (mentioned  earlier)  and  the  "S"  cards  discussed  in 
paragraph  C.  3. 1. 
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APPENDIX  D 

FSPT  DOCUMENTATION  OF  B-52G  AND  B-52H  AIRCRAFT 


FSPT  DOCUMENTATION  OF  B-fiJG  AND  B-52H  AIRCRAFT 


This  appendix  contains  the  functional  relationship  diagrams  and  a listing  of  the 
keypunch  cards  that  comprise  the  FSPT  safety  model  documentation  for  the  B-52G  and 
B-52H  aircraft. 


D.  1 DIAGRAMS 


Title 

Page 

Propulsion,  Diagram  B-1 

D-5 

Propulsion,  Diagram  B-2 

D-6 

Propulsion,  Diagram  B-3 

D-7 

Propulsion  Fuel,  Diagram  B-4 

D-8 

Propulsion  Fuel,  Diagram  B-5 

D-9 

Propulsion  Fuel,  Diagram  B-6 

D-10 

Comm/Nav/ldent,  Diagram  C-1 

D-11 

Comm/Nav/ldent,  Diagram  C-2 

D-12 

CommA^av/ldent,  Diagram  C-3 

D-13 

Information  & Display,  Diagram  D-1 

D-14 

Information  & Display,  Diagram  D-2 

D-15 

Environmental  Control,  Diagram  E-1 

D-lf) 

Environmental  Control,  Diagram  E-2 

D-17 

Environmental  Control,  Diagram  E-3 

D-18 

Flight  Control,  Diagram  F-1 

D-19 

Flight  Control,  Diagram  F-2 

D-20 

Flight  Control,  Diagram  F-3 

D-21 

Flight  Control,  Diagram  F-4 

D-22 

Ground  Control,  Diagram  G-1 

D-23 

Landing  Gear,  Diagram  L-1 

D-24 

Mission  Support,  Diagram  M-1 

D-25 

1. 
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Vfc, 


I 

Title 

Utilities,  Diagram  U-1 
Utilities,  Diagram  U-2 
Utilities,  Diagram  U-3 
Utilities,  Diagram  U-4 

D.  2 CARD  LISTING 

Pages  D-31  through  D-114  are  a reproduction  of  the  punchcard  listing.  The  list- 
ing is  alphabetical  by  "alpha  designator",  and  the  format  is  that  of  the  80-column 
punchcard  itself  as  described  in  Appendix  C.  At  the  top  of  each  page  the  card  columns 
are  printed  vertically;  for  example,  column  34  Is  printed 


Page 

D-26 

D-27 

D-28 

D-29 


The  first  two  columns  of  the  punchard  are  coded  "52".  If  the  third  column  is 
blank,  the  card  is  common  to  both  versions  of  the  aircraft.  Cards  peculiar  to  one 
version  of  the  aircraft  carry  a designator  in  column  3 for  the  aircraft  — "G"  for  the 
B-52G  and  "H"  for  the  B-52H. 
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42bKV 

UATABV 

DATA 
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VALVFiOIL  TtMP  CGNTMtlL 

42PPW 

UATARW 
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f ILTER.4tTU8N  01 L 
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UATABX 

DATA 
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RFCOLATaOtAIR  PRESS 

42bHY 

UATABY 

UAT  A 
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SWlTCHfPRESSURE 

42  HU  2 

UATABZ 
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GcARBUX  AOAPTEP 

42r,CH 

UATACH 

UATA 
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CAP, GEN  AIR  INLET  COOLING 

42  UAH 

UATAH 

UAT 

0 
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42UAJ 

UATAJ 

UAl 
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42PAK 

UATAK 

UAT 
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PLATE, OEN  tXJICX  ATTACH 
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UATAH 
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JATC 
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42CCG 

UATCCG 

UATC 
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62 
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UATCCH 

UATC 
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UATC 
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A 
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AAAAAAAAA 
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1 

62 
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UATO 

2 
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UATO 
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FAAAAAAAAA 
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AAAAAAAAA 
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FAAAAAAAAA 
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F ILTFU.OPIVL  UNIT 
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UAUARPB 

UAUA 

1 

■ij'l 

9LATt',C!?D  UUICK  2TTAr.ll 

‘tZiii-  3 

UAUARUC 

UAUA 
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•J . ^ 

I'iCKPiNG  CSl  OUlLK 

APhh*, 

uauahbd 

UAUA 
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>•1  ANI9F,  I NPUT  ynUNT 

4. •’10' 9 

UAUABBE 

UAUA 
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•>2i: 

Ai.APrfW  ASSY  ALT  CUUlINu 

42t  PO 

UAUAHRF 

UAUA 

1 

-jd~j 

Sii  XL  T,t»'1WHk  INPUT  l)F1V2 

42  U L 

UAUAbt 

UAUA 

A 

d2'; 

H liJS  1 'Jf.fUr-AR  AND  ACClSS. 

42PF  F 

llAUARk 

UAUA 

A 

■j2 
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42t  ! 0 

UAUAIU. 

UAUA 

A 
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jVtP>’B,LIf'n 
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UAUABH 

UAUA 
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42KPM 

UAUAbM 

UAUA 

1 

jT 

TANK, OIL 

4 9f  t'K 

UAllAbh 

UAUA 

0 

i>'J,;T,'11L  CUfiL  2lP  INLtl 

42PIT 

UAUABT 

UAUA 

1 

i’i)CT,niL  ClK.L  AU  f-KHXUSI 

4?bPU 

UAUABU 

UAo  A 

1 

•>2 

Ci.'.’Lf:K,(IIL 

42FPV 

UAUARV 

UAUA 

1 

I'i 

V^LVk.nil  TL''.P  r.(,(vTwriL 

42  oP  W 

UAUARW 

UAUA 
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42f.bX 

UAUAbX 

UAUA 
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UAUAbY 

UAUA 

1 
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42GtZ 

UAUABZ 

UAUA 

1 
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42PLH 

UAUACH 

UAUA 

1 
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421  ah 

UAUAH 

UAU 

U 

■5  1’ 
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U4UAJ 

UAU 

1 

'■>2 

DDCT  .eXHAUSTCCiLLECT  LDwr  F 
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UAUAK 

UAU 

1 
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PLATl.GFN  OUICK  ATTACH 

4?f  A M 

UAUAM 

UAU 

1 

■>?.n 

LOCK  king 

4i  EAN 

UAUAN 

UAU 

1 

■jZ 
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UAU8 

UAU 

AAAAAAAAA 
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42CfP 
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UAJb 

A 

■'2 
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A 
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A 
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UAUCCJ 
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A 

92 

PACKA.3f  .ClJPfttAJT  CtlAThPL 

42CLK 

UAUCCK 

UAUC 

A 

9 2 

P'^LAY.PIFF  t'tACT  PFOTlCT 

42CLN 

UAUCCN 
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A 
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UAUO 

UAUF 

AAAAAAAAA 

32 
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1 

92u 
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UAUO 
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2 
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UAUO 

2 
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C 
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2 
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49Dt  F 
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2 
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UAUOEG 

UAUO 

2 
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490rH 

UAUOEH 

UAUD 

2 
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UAUOEJ 

UAUO 

2 

32 
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UAUDPD 

UAUO 

1 

52 
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51CPE 

UAUOPE 

UAUD 

1 

92 

AMMr":  TIP 

5lCP»i 

UAUOPH 

UAUO 

1 

92 

GENFKATPR  MC. 7 C JNTrOL 

UAUE 

UAU 

AAAAAAAAA 
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PANEL, A-C  CONTHUL 

4?CAA 

UAUEAA 
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-V 

.’A'lt  LtHVOR'UJUC  C■)^  I'V.a 

25CAA 

LUHAK A A 

LUHAK 

1 

52 

Pi''lFL  .MYUKAUl  1C  ClMKl  L 

45CA  A 

KUHAKAA 

RUHAK 

1 

52 

i‘  ^ SSlUc  W'tJMNG  SwlTCd 

4 5CC  1 

LUHAKRF 

LUHAK 

A 

52 

(<u35Ui<k  wAKNlM,  SvJllCH 

‘t5(  C2 

RUHAK BF 

KUHAK 

A 

52 

WA^NINO  Lir.HT 

S91KB 

LUHAK2B 

LUHAK 

1 

52 

LIGHT 

V9C6B 

RUHAKZ8 

RUHAK 

1 

52 

MIL‘!T  ACriHN 

UHAL 

UHFL 

AAAAAAAAA 

52 

-MLOT  ACTIHN 

UHAL 

UHFR 

AAAAAAAAA 

52 

‘’A\lL*HYDKAUL  IL  CGNT'<''L 

A5LaA 

UHALAA 

UHAL 

1 

52 

LIFT  1N3.I  HYi’  f'IST 

LUHtS 

FDR 

AAAAAAAAA 

52 

L^.=  T mYj  ‘lilOY  f'IST 

LUHD 

GAA 

111111111 

52 

LUHB 

LCU 

A A A AA  A AA  A 

j2 

- 1 .HT  INisn  HY.J  D1  ST 

RUHR 

FCY 

aAAAA A ;a A 

52 

.'I'.hT  HYO  rtGOY  GIST 

RUHo 

GAA 

111  11 1111 

52 

RUH6 

LC? 

AAAAAAAAA 

52 

SYSTEM  PkFSSURF 

LUHFD 

LUHB 

AAAAAAAAA 

52 

SYSTtM  PKtSSUkE 

LUHHD 

LUHBJ 

Fllllllill 

52 

SYSTrM  2«ESS(J«f 

RUHHIJ 

RUHi) 

At'  AA  AA  A A A 

52 

system  tVESSOPE 

RUH5D 

RUHBJ 

rlllllllil 

5t 

VALVE  ,P2tSSUKt  HtLIPF 

45LC  P 

LUHBOCP 

LUHBD 

2 

52 

V.'l  Vi  .PivESSUKF  FFlIf  F 

65f  L P 

RUHRDCP 

PUHBD 

2 

5 3 

I LTFK,P«ESSHRt  L IGf 

45(  CT 

LUHUUCT 

LUH30 

1 

52 

F IL  TL  R.PkFSSURL  L INil 

45Ct  T 

RUHBOCT 

RUH30 

1 

52 

f UT  P ELFMf  NT 

45CCU 

LUHBOCU 

LUHBG 

U 

52 

-iLTrP  clF'AFfJT 

45CCG 

PUH5UCU 

RUHiiO 

U 

5 2 

I>LU'«'>1'IG/FIT1  ilgs 

59Cf  A 

LUHBIjZA 

LUHBJ 

1 

ji. 

I>LUM'<  ING/  FI  TT  IM,S 

99C(  A 

R 1 IH  bO  Z A 

RUHbO 

1 

52 

system  PHF.SSU’! 

LUMPE 

LUHBD 

AAA  AA  A A A A 

52 

Ni,!WMAL  SYSTEM  PF'.SSUkL 

LUHbfc 

LUH8K 

Fllllllill 

52 

M'UMAL  SYSfFw  PPtsSGKE 

RUHbE 

RUHBO 

AAAAAAAAA 

52 

I'ifCMAL  system  FPuSSdEE 

RUHBE 

RUHBK 

Fllllllill 

52 

VALV*  ,F  I'iFRAl.L  SHUTfiFi 

45CCG 

LUHBECG 

LUHBE 

A 

52 

VALVi.  ,5  I UWALL  SHllTfFF 

45C.CG 

RUHBECG 

RUHBE 

A 

5/ 

F I T T I MG , JU I CK  0 I S ( .TA  N EC  T 

45CCH 

LUHbfcCH 

LUHbfc 

1 

52 

1 ITT  IMG.  illlCK  (‘ISCGGNECT 

45f  CH 

PUHBECH 

RUHufc 

1 

52 

PUHP.L'ji,  oRIVFN  HYIr'AULIC 

45C(  J 

LUHBECJ 

LUHBF 

A 

5 2 

?il3P,F'!G  OKIVFN  HYOkaOLIC 

45(C  J 

RUHBECJ 

RUHBE 

A 

52 

GPrilllH)  SERVICE 

LUHBF 

LUHrtU 

OOOOUUwOO 

52 

GPiIlINU  SERVICE 

RUHBf 

RUHeO 

ocooooouo 

52 

noMP.GHll'JNG  TEST 

45(  CV 

LUHBF CV 

LUHBF 

A 

52 

E'H3P,GP' :1N ; IfSI 

45CCV 

RUUBFCV 

><UHBF 

A 

52 

Mi,TnH,GRHUVtJ  TEST  Plli-tp 

45CCY 

LUHrtf  CY 

LUHBF 

A 

52 

M 'TOrc  .(JPOUNfJ  TEST  PIMP 

45CCV 

RUHHFCY 

PUHBF 

A 

52 

ELHIl'  SUPPLY 

LUHbG 

LUHBF 

AAAAAAAAA 

52 

ELOIU  SUPPIV 

LUHt'G 

LUHBF 

FAAAAAAAAA 

52 

FLU  10  SUPPLY 

RUHBG 

RUHBE 

AAAAAAAAA 

52 

•^luIl)  supply 

RUHHG 

RUHBF 

F AAAAAAAAA 

I 0-ni 
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'Jc 

"rirKVl’lK  ,NY()PaUL  1C 

45CL  A 

LUHBGCA 

1 LUHBG 

A 

b2 

■^rs;  :"!V'iI4,HYUHAULU. 

4 51.1  A 

RUHBGCA 

BUHBG 

A 

Jt. 

'■  I L I c P,  METIJWM  1 INt 

45CC.L 

LUHBGCL 

LUHBG 

1 

t It  Tt  P, RETURN  LINE 

4 5tCL 

RUHBGCL 

• RUHBG 

1 

■iZ 

Fiir^p  element 

45rCM 

LUHBGCH 

LUHBG 

U 

5 2 

r UTCR  lLEMENT 

45(.CM 

RUHBGCM 

PUHBG 

0 

52 

USr-vVaiR  PRESSURE 

LUH8H 

LUHBG 

A A A A A A AA  A 

52 

►LSEPVTlK  PRESSURE 

RUHBH 

RUHBG 

AA A AaA  AA A 

5? 

5li<AINi.R, ENGINE  BLELU  Aik 

46CCr 

LUHBHCC 

LUHBH 

0 

52 

STkA INERf ENGINE  8LLFD  AIR 

45rrc 

RUH8HCC 

RUHBH 

0 

5? 

VMVl.RES  Aik  RELIEF  3EACH 

99Ctb 

LUHBHZG 

LUHBH 

1 

5t 

Y.>LV..,R£S  air  kELItF  3EACH 

99CCB 

RUHBHZG 

1 RUHBH 

1 

52 

PRESSURE  INOICATOk 

LUHBJ 

LUHBL 

imiiiii 

52 

Pr-ISSURE  INniCATOR 

RUHBJ 

RUHBL 

iiiiiiiii 

52 

•M  lEL.HYORAUL  IC  CONTRIIL 

45CAA 

LUHBJAA 

LUHBJ 

1 

52 

•’WELtHYURAUL  IC  CONTROL 

45CAA 

RUHBJAA 

RUHBJ 

i 

52 

SSURE  INDI  CAT'^R 

51CFA 

LUHUJEA 

LUHBJ 

A 

52 

PPPSSHRE  INOICATOR 

51CF  A 

RUH6JEA 

'RUHBJ 

A 

52 

PRESSURE.  TRANSMITTER 

5ir.FC 

LUHBJFC 

LUHBJ 

A 

5 2 

pyiSSURE  TkANSMITTEK 

51CEC 

RUHBJ EC 

RUHBJ 

A 

52 

L'.>w  PRESSURE  EARNING 

LUHBK 

LUHBL 

lllllllll 

52 

LO.J  PRESSURE  WARNING 

RUHBK 

RUHBL 

llllUlll 

52 

PANEL tHYORAUL 1C  CONTROL 

45CAA 

LUHBKAA 

LUHBK 

1 

52 

PANE! .HYJPAUL IC  CONTROL  , 

45r  AA 

RUHBKAA 

RUHbK 

1 

52 

Sk  I TC.H, PRESSURE  WARNING 

45CC2 

LUHBKCZ 

1 UHdK 

A 

52 

.SwI  TCHfPRESSURE  WARNING 

45CCZ 

KUHBKCZ 

. RUHBK 

A 

52 

ARRER  WARNING  LIGHT 

99CPB 

LUHBK ZC 

LUHBK 

A 

52 

^MREK  WARNING  LIGHT 

99CBB 

RUHBKZC 

RUHBK 

A 

5? 

PILOT  AWARENESS 

LUHBL 

LUHBLA 

UllllUl 

52 

PIlUT  AWARENESS 

nUHBL 

RUHBLA 

uiiinii 

52 

ATTENUATION  NO  1 

LUHBL  A 

LUHBLB 

iniiiiii 

52 

ATTENUATION  NO  1 

RUHBLA 

RUHBLB 

lllllllll 

52 

ATTENUATION  NO  2 

LUHBL B 

LUHb 

lllllllll 

5? 

ATTENUAT! ON  NO  2 

RUHBLB 

RUHB 

mil  nil 

52 

LEFT  BODY  HYD  OIST 

LUHC 

FFKL 

AAAAAAA/tA 

• 

52 

LEFT  BODY  HYO  GIST 

LUHC 

FCM 

lllllllll 

52 

LEE  I HYO  BOOY  GIST 

LUHC 

GBB 

lllllllll 

52 

LEFT  HYG  BOGY  GIST 

LUHC 

GBO 

lllllllll 

52 

LUHC 

LAK 

lllllllll 

1 

52 

left  body  HYG.  OIST. 

LUHC 

MCA 

AAAAAAAAA 

1 

52 

RIoHT  BUOY  HYO  GIST 

RUHt 

FBKL 

AAAAAAAAA 

52 

PIGHT  buoy  hYD  OIST 

kUHC 

FCM 

immii 

) ■ 

52 

RIGHT  HYO  BUOY  OIST 

RUHC 

GBB 

immii 

I 

5«: 

RIGHT  HYO  BUOY  OIST 

RUHC 

GbG 

mmm 

52 

RUHC 

LAK 

lllllllll 

: 

52 

RIGHT  BOOY  MYU.  OIST. 

RUHC 

MO 

AAAAAAAAA 

52 

SYSTEM  PRESSURE 

LUHC  A 

LUHC 

AAAAAAAAA 

52 

SYSTEM  PRESSURE 

LUHCA 

LUHCG 

Flllllllll 

52 

SYSTLM  PRESSURE 

RUHCA 

RUHC 

AAAAAA  AAA 

52 

SYST-M  PRESSURE 

RUHC  A 

RUHCG 

Fimmii 

.1 

Vt 

1 .^1121  - 

i 

1 

1 

r 
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•*>  ^ 

VAlVi  ,'*AMJAl  CHlCK 

R3C  CR 

LUHCAER 

LIIHCA 

1 

•.i 

VALVl  .MANUAL  CHICK 

A3CER 

BUHCABR 

RUHCA 

1 

■>»; 

f-lUP-  SUPPLY 

LUHCD 

UHGL 

AAAAAAAAA 

j.' 

(L'Jl'  SUPPLY 

LUHCD 

UHHL 

FAAAAAAAAA 

•j,' 

fLiJli'  SUPPLY 

RUHCO 

UHGK 

AAAAAAAAA 

‘jT 

“LUIO  SUPPLY 

RUHCO 

UHHR 

F AAAAAAAAA 

M St-V  ‘Ik.HYUKAUL 1C 

RSCl'A 

LUHCDDA 

LUHCD 

2 

S'  '.Vu!  9 ,,!YDhAUL  IC 

43Cu  A 

RUHCOOA 

RUHCO 

2 

- n r''k,f*l  TUKN  L INF 

43Cnj 

LUHCDDJ 

LUHCD 

1 

r IL!.-H,fiLTUPN  HMt 

a3i  0 J 

RUHCDOJ 

9UHCO 

1 

3^; 

1 1 1 T. K rLFMbNT 

RSCfiK 

LUHCODK 

LUHCD 

0 

f It  TC9  FLF  *F\T 

A3(  OK 

RUHCDOK 

RUHCO 

c 

'■uSLKVni*-  PRcSSUKt 

LUHCE 

LUHCD 

222222222 

32 

f.Srkv/'ilK  PKtSSURE 

RUHCE 

RUHCD 

222222222 

32 

VALVF.SfS  AIP  PHfSS  klLUr 

95COE 

LUHCEUE 

LUHCE 

1 

32 

VALVu.lES  AIP  PRlSS  KtLlCF 

A5CPF 

RUHCEDF 

RUHCF 

1 

32 

jT^NiJ.iY  -■'fsewve  SUPPLY 

LUHCF 

UHHL 

111111111 

32 

RUHCF 

UHHR 

111111111 

32 

STANuhY  kfslrve  tank 

SSXbh 

luhcfzb 

LUHCF 

A 

34 

STAM.'PY  PfcSEKVE  TANK 

RSCDB 

KUHCFZB 

PUHCF 

A 

32 

PK3SSU''l  INDICATION 

LUHCG 

LUHCJ 

111111111 

32 

PPi.-ShUtil  IMOICATIDN 

KUHCG 

RUHCJ 

111111111 

52 

PKt.Sbt)9F  INDICATOR 

51tE  A 

LUHCGEA 

LUHCG 

A 

32 

pklSSUKL  INDICATOR 

31CE  A 

RUHCGEA 

RUHCG 

A 

■jZ 

PPcSSURt  TuANSNITTER 

51CEC 

LUHCGFC 

LUHCG 

A 

32 

PRESSURE  TRANSMITTER 

51fEC 

RUHCGFC 

RUHCG 

A 

32 

LOR  PRESSURE  WARNING 

LUHCH 

LUHCJ 

111111111 

32 

LOR  PRESSURE  wAkNiNO 

RUHCH 

RUHCJ 

111111111 

32 

SWI  TCH, PRESSURE  WAR^'lNG 

A3LEU 

LUHCHFU 

LUHCH 

A 

32 

SWI TCH, PRESSURE  WARNING 

A5CEU 

RUHCHEU 

RUHCH 

A 

32 

AMREP  WARNING  LIGHT 

99LbP 

LUHCHZE 

LUHCH 

A 

52 

AM3.tK  WARNING  LIGHT 

99CHB 

RUHCH ZF 

RUHCH 

A 

32 

PlI.^T  ACTlr.N 

LUHCJ 

UHHL 

llllllill 

52 

DILGT  ACTIUN 

RUHCJ 

UHHR 

iiiiiiin 

32 

i'anll.hyopaul ir  contriil 

R3r  A A 

LUHCJAA 

LUHCJ 

1 

52 

PANEL, HYDRAUL IC  CUNTkDL 

45CAA 

RUHCJAA 

RUHCJ 

1 

32 

MANIFOLDS, 5 EACH 

99CDA 

LUHCZA 

LUHC 

2 

32 

''ANIEDLUS,  5 EACH 

99CDA 

ruhcza 

RUHC 

2 

32 

normal  pressure 

UHEL 

LUHAD 

UHFL 

llllllill 

32 

NOR^•AL  PRESSURE 

UHFL 

LUHAK 

FAAAAAAAAA 

32 

valve, FIREWALL  SHUTIjFE 

R5CBL 

UHFLBL 

UHEL 

A 

32 

r ITTING, QUICK  DISCUNNlCT 

A5CBM 

UHELBH 

UHEL 

A 

52 

PUMP.ENC  DRIVEN  HYO 

95CBN 

UHEL BN 

UHEL 

A 

52 

NORMAL  PRESSUKL 

UHFR 

HUHAO 

UHFR 

llllllill 

32 

NORMAL  PRESSURE 

UHER 

RUHAK 

FAAAAAAAAA 

52 

VAl  V£ , FIREWALL  SHUTOFF 

R5CEL 

UHEkBL 

UHER 

A 

52 

FITTING, QUICK  OISCONNLCT 

45CBM 

UHEPBM 

UHER 

A 

52 

PUMP, ENG  DRIVEN  HYU 

A5CBN 

UHER BN 

UHER 

A 

32 

STANDBY  PRESSURE 

UHEL 

LUHAD 

K UHEL 

AAAAAAAAA 

52 

PUMP, standby 

45tB2 

UHFLBB 

UHEL 

A 

pr.t'.ins.  jiKi 
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52 

.hVO  STANUBY  PUMP 

45Cti3 

UHFLBC 

UHFL 

A 

5? 

SlA.Nliav  PFESSURE 

UHFR 

RUHAD 

K 

UHER 

AAAAAA AAA 

52 

‘•u*-ip,  standby 

M51B2 

UHERBB 

UHER 

A 

52 

iTdK.HYO  STANDBY  PUMP 

45Cri3 

UHFPBC 

UHFR 

A 

52 

gJr.’M'Vl  PRESSURE 

UHGL 

1 UHCA 

UHHL 

lllllllll 

52 

N l^vMAL  PRESSURE 

UHGL 

LUHCH 

Flllllllll 

52 

- ITTING.OUICK  DISCONNECT 

45C0G 

UHGLOG 

UHGL 

1 

52 

V \L  VP  ,E  IKEWAl  L SHUTfiEE 

45CDH 

UHGLOH 

UHGL 

A 

5t 

P.I-t|>,ENv.  OKIVEN.HYO 

45CTG 

UHGL EG 

UHGL 

A 

D? 

( U TcK, PRESSURE  L INf 

T5C.IH 

UHGLEH 

UH.,l 

1 

52 

1 IETm'  ELEMENT 

45LE  J 

UHGLEJ 

UHGL 

0 

5 2 

JiWMaL  pressure 

UHGR 

RUHCA 

UHHR 

lllllllll 

52 

'i  i-’MAL  PRESSURE 

UHGR 

RUHCH 

Fill  111  111 

52 

rnTlNG.OUICK  DISCUNNECT 

45CDG 

UHGROG 

UHGR 

1 

5? 

VALVP, FIREWALL  SHUTOFF 

45CDH 

UHGROH 

UHGR 

A 

Si 

PUMP, EMU  DRIVEN  HYD 

45Ci  G 

UHGR EG 

UHGR 

A 

52 

P n TLH .PRESSURE  L INE 

45CIH 

UHGREH 

UHGR 

1 

52 

EILTtP  ELEMENT 

45CE  J' 

UHGREJ 

UHGR 

0 

52 

SrANDDY  PRESSURE 

UHHL 

LUHCA 

K 

UHGL 

AAAAAAAAa 

52 

F ILTtR.STANDBY-SYSTtM 

45CFP 

UHHLEP 

UHHL 

1 

52 

EILTFR  ELEMENT 

45CEy 

UHHLEO 

UHHL 

0 

52 

PUMP, STANDBY 

45CFS 

UHHLES 

UHHL 

A 

52 

MOTOR, HYO  STBY  PUMP 

45CET 

UHHLET 

UHHL 

A 

52 

STANDBY  PRESSURE 

UHHR 

RUHCA 

K 

UHGR 

AAAAAA AAA 

52 

F ILTLk, STANDBY  SYSTEM 

45CeP 

UHHREP 

UHHx 

1 

52 

FILTER  ELEMENT 

45CEa 

UHHREO 

UHHR 

0 

52 

PUMP, STANDBY 

45rES 

UHHRES 

UHHR 

A 

52 

■1uT0P,HYD  STBY  PUMP 

45CET 

UHHRET 

UHHR 

A 

•32 
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UX 
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